124688 - <script src="https://..."> makes lock icon appear

Status: VERIFIED WORKSFORME

(Core Graveyard :: Security: UI, defect, P1)

Description

[Jesse Ruderman]

To reproduce: load http://www.staffordconsolidation.com/coninfo.cfm.

Result: yellow or red lock icon, usually yellow.  If there's a red icon, you
also see a mixed-https-and-http dialog.

Expected: unlocked lock icon, since the page is http.

I will attach testcases that show:
1. A page with a <script src="https://..."> gets a yellow lock icon even if its
URL is http.  The script src can be a 404 and this will still happen.
2. If the https URL in the script tag redirects to an http URL, the page gets a
mixed-https-and-http dialog and a broken (red) lock icon.

Comment 1

[Jesse Ruderman]

Attachment: script src=https

Comment 2

[Jesse Ruderman]

Attachment: script src=https, but https url redirects to http

Comment 3

[Stephane Saux]

confirming with build 2002031103.
David, this seems similar to bug 125807 but the fix doesn't seem to take this
into account.

Comment 4

[David P. Drinan]

Works for me with the latest commercial build (20020314). I will try a mozilla
build next.

Comment 5

[Stephane Saux]

Can't seem to reproduce with 2002031403 build.

Comment 6

[Jesse Ruderman]

Mozilla 2002 031403: WFM on the testcases, but I still see the bug at
http://www.staffordconsolidation.com/coninfo.cfm.

Comment 7

[Kai Engert [:KaiE:]]

This bug should be fixed by the bug attached to bug 130949

Comment 8

[John Unruh]

Works for me with the test build mention right above, from kaie.

Comment 9

[John Unruh]

Verified with the 4/1 Win2000 trunk build.

Comment 10

[Jesse Ruderman]

WFM 2002 040303 Win98.